chore(deps): Bump dotenv from 17.4.2 to 18.0.1

[dependabot]

Bumps dotenv from 17.4.2 to 18.0.1.

Changelog

Sourced from dotenv's changelog.

18.0.1 (2026-09-18)

Changed

• Handle file urls in config logging (#1054)

18.0.0 (2026-09-17)

Added

• NEW: Dotenv now has a CLI. (#1022)

$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv

• NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#1010)

$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv

Changed

• Injecting message sent to stderr rather than stdout and tips removed (#1037)

Removed

• Remove tips (#1031)
• Remove skill files (#1032)
• Remove Spanish README (#1034)
• Remove .env.vault support (#1033)
• Remove preloading. Instead use cli dotenv run -- your-command (#1035)

Commits

• ce3bfb4 18.0.1
• 294230e changelog
• 4fcffd4 Merge pull request #1054 from jakezwang/fix-url-path-logging
• 8ea84d6 fix: handle file URLs in config logging
• 2815fa8 18.0.0
• 451c6cb add spacing
• 7c7ed02 update README and changelog
• 7454f56 Merge pull request #1052 from motdotla/cli-cleanup
• f5de622 .cmd coverage
• 75289b1 changelog
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note

Low Risk

Overview
Bumps the dotenv dependency in packages/model-provider/package.json from version 17.4.2 to 18.0.1. This update incorporates the changes from the dotenv 18.x release line, including the 18.0.1 patch that handles file URLs in config logging. No other files are affected by this dependency upgrade.

^{Written by Gitzilla for commit 2fbbac2. This will update automatically on new runs. Configure in the Gitzilla dashboard.}